The EU Data Retention Directive required retention of telecommunications metadata to make investigation, detection and prosecution of terrorism and serious crime more effective. In April 2014, the ruling in the case Digital Rights Ireland declared the Directive invalid on the grounds that it violated the rights to privacy and data protection and failed to meet the requirements of proportionality. The article describes the legal implications of the ruling for data retention and the actual judicial and legislative responses to the judgment. In several Member States, the domestic implementation laws were declared unconstitutional by constitutional courts after the ruling, while several Member State governments have kept the data retention laws in place. Our conclusion is that the courts seem to take more serious approach to the protection of privacy, while the governments are more likely to stress their sovereignty, following an interpretation that limits the effect of fundamental rights.